Data security, according to a study by compliance consulting firm LRN.

When surveyed by LRN, 52% of executives said electronic data protection was the top risk they were worried about. Almost as many (47%) said “data privacy.”

Those two were higher than sexual harassment, executive corruption, safety and other issues.

Why are companies so worried about data? The answer is two-fold, says LRN: The amount of electronic information companies have is growing, and it’s coming into greater focus because of new “electronic discovery” rules that dictate what info companies need to keep in case of a court visit.

The firm’s advice for staying compliant:

• Develop privacy and data security policies
• Periodically audit information storage practices, and
• Educate employees on the impact of lost or stolen data.

What difference can a deleted e-mail make? For one employer, it might be the difference between winning and losing a lawsuit.

A woman sued her former employer, claiming she was fired for taking FMLA leave. The company claimed she was let go in a restructuring that would’ve happened even if she didn’t take leave. But the judge didn’t buy it, and now the case will be tried by a jury.

One key piece of evidence against the employer: a deleted e-mail explaining why the woman was fired. Here’s what happened, according to the court opinion:

After the woman was fired, her manager sent an e-mail explaining the termination to the rest of the department. When she said she was suing, the manager was told to save all relevant documents – including e-mail – in preparation for litigation. But the e-mail was deleted anyway. (The employee got a copy, and brought it to the court.)

The manager said it was erased by mistake, but the judge didn’t believe the story. He ordered the company to be sanctioned. That means when the case goes to trial, the jury will be told the company deleted the e-mail on purpose, presumably to hide incriminating evidence.

New rules being enforced

The decision shows just how seriously new “e-discovery” rules are being taken. The rules, passed in December of 2006, hold companies accountable for preserving electronic evidence.

For HR, the most important part of the rules is the concept of a “litigation hold.” Most companies have a policy to delete e-mail and other documents on a regular basis. However, once a company thinks it might be heading to court, it has a responsibility to start saving any data that might be important to the case.

Lessons learned

In this case, the company told the woman’s former supervisor about the hold – but made the mistake of trusting her to preserve everything she needed to.

Planning ahead could have given the company a better way to make sure the data was being saved. For example, the IT department might have started archiving every message that mentioned the employee, or saving everything sent by people involved in the hiring decision.

Also, it’s a good practice to save termination e-mails and other messages in ex-employees’ personnel files, even if there’s no indication they’re going to sue. That will prevent problems like this if a lawsuit is brought, and in most cases, the extra evidence will only help the company.

Cite: Connor v. Sun Trust Bank

Out of all the e-discovery decisions made since the new rules went into effect in ’06, roughly 25% were related to employment law cases. Why is that? Part of it is the large number of employment lawsuits that get filed. Also, a lot of employee-employer communication is done electronically.

In other words, in an employment lawsuit, a good chunk of the evidence is located in the employer’s computer system. And since the company owns the system, it has the responsibility to retain the relevant data.

Being accused of destroying that evidence can come with a hefty price tag. The high number of rulings resulting from employment litigation emphasize the fact that HR and IT need to work together to avoid getting hit with sanctions for violating the rules. Here are some things to keep in mind:

• Watch what you get rid of when an employee is fired. A lot of companies wipe the ex-employee’s hard drive clean so a new employee can use the computer. That makes sense, but if there’s any indication he or she might sue, it’s the company’s responsibility to back-up that data.
• Prepare for retaliation claims. Those cases are a big source of a lot of e-discovery rulings. Once an employee complains about discrimination or harassment, that’s usually enough of a notice of possible litigation to require companies to preserve evidence. That includes documents related to the investigation evidence of how the employee is treated afterward.
• IT and HR need to communicate. HR is often the first to know about impending lawsuits from current and former employees. IT knows what needs to be done to hold on to key documents. Therefore, it’s important to keep communication open to make sure the evidence gets preserved.